From d6caac4a97d42537f604d0d598fd35082ce5c26e Mon Sep 17 00:00:00 2001
From: Alexandru-Victor Macocian <amacocian@microsoft.com>
Date: Thu, 30 Oct 2025 17:59:18 +0100
Subject: [PATCH] Fixes for disk usage

---
 custom-metrics/disk-usage.sh       | 4 ++--
 logstash/conf.d/22-disk-usage.conf | 9 ++++++---
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/custom-metrics/disk-usage.sh b/custom-metrics/disk-usage.sh
index 287af82..79d35d8 100644
--- a/custom-metrics/disk-usage.sh
+++ b/custom-metrics/disk-usage.sh
@@ -36,8 +36,8 @@ for i in {1..6}; do
             # Mount point is everything from column 9 onwards
             mount=$(echo "$line" | awk '{for(i=9;i<=NF;i++) printf "%s%s", $i, (i<NF?" ":""); print ""}')
             
-            # Skip entries with 0 blocks (pseudo filesystems) or starting with dash
-            if [[ -n "$mount" && -n "$used" && -n "$blocks" && "$blocks" != "0" && ! "$filesystem" =~ ^- ]]; then
+            # Skip entries with 0 blocks (pseudo filesystems) or filesystem starting with dash
+            if [[ -n "$mount" && -n "$used" && -n "$blocks" && "$blocks" != "0" && "$filesystem" != "-" ]]; then
                 used_bytes=$((used * 512))
                 total_bytes=$((blocks * 512))
                 echo "$timestamp $mount $used_bytes $total_bytes" >> "$LOGFILE"
diff --git a/logstash/conf.d/22-disk-usage.conf b/logstash/conf.d/22-disk-usage.conf
index d6b2365..466d79c 100644
--- a/logstash/conf.d/22-disk-usage.conf
+++ b/logstash/conf.d/22-disk-usage.conf
@@ -1,14 +1,17 @@
 filter {
   if [type] == "disk" {
-    dissect {
-      mapping => {
-        "message" => "%{timestamp} %{system.disk.mount_point} %{system.disk.used} %{system.disk.total}"
+    # Parse the message: "timestamp mount_point used_bytes total_bytes"
+    # Mount points can have spaces, so we use grok with greedy matching
+    grok {
+      match => { 
+        "message" => "^%{TIMESTAMP_ISO8601:timestamp}\s+(?<system.disk.mount_point>.*?)\s+%{NUMBER:system.disk.used:int}\s+%{NUMBER:system.disk.total:int}$"
       }
     }
 
     date {
       match => ["timestamp", "ISO8601"]
       target => "@timestamp"
+      remove_field => ["timestamp"]
     }
 
     mutate {